{"record":{"id":"62d2bd9da19d0a38","repo":"kubernetes/kops","slug":"creation-of-route53-hosted-zones-is-not-supported","errorCode":null,"errorMessage":"Creation of Route53 hosted zones is not supported for terraform","messagePattern":"Creation of Route53 hosted zones is not supported for terraform","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/dnszone.go","lineNumber":293,"sourceCode":"\t\t\t\tklog.Infof(\"No association between VPC %q and zone %q; adding\", vpcName, aws.ToString(z.HostedZone.Name))\n\t\t\t\ttf := &terraformRoute53ZoneAssociation{\n\t\t\t\t\tZoneID: terraformWriter.LiteralFromStringValue(*e.ZoneID),\n\t\t\t\t\tVPCID:  e.PrivateVPC.TerraformLink(),\n\t\t\t\t}\n\t\t\t\treturn t.RenderResource(\"aws_route53_zone_association\", *e.Name, tf)\n\t\t\t}\n\t\t}\n\n\t\treturn nil\n\t}\n\n\t// Because we expect most users to create their zones externally,\n\t// we now block hostedzone creation in terraform.\n\t// This lets us perform deeper DNS validation, but also solves the problem\n\t// that otherwise we don't know if TF created the hosted zone\n\t// (in which case we should output it) or whether it already existed (in which case we should not)\n\t// The root problem here is that TF doesn't have a strong notion of an unmanaged resource\n\treturn fmt.Errorf(\"Creation of Route53 hosted zones is not supported for terraform\")\n}\n\nfunc (e *DNSZone) TerraformLink() *terraformWriter.Literal {\n\tif e.ZoneID != nil {\n\t\tklog.V(4).Infof(\"reusing existing route53 zone with id %q\", *e.ZoneID)\n\t\treturn terraformWriter.LiteralFromStringValue(*e.ZoneID)\n\t}\n\n\treturn terraformWriter.LiteralSelfLink(\"aws_route53_zone\", *e.Name)\n}\n","sourceCodeStart":275,"sourceCodeEnd":304,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/dnszone.go#L275-L304","documentation":"kOps deliberately refuses to generate terraform that creates Route53 hosted zones. Terraform lacks a strong notion of unmanaged resources, so kOps cannot tell whether it created the zone (and should output it) or whether it already existed. Users are expected to manage the zone externally.","triggerScenarios":"Running kOps with --target=terraform when the cluster's DNS is a Route53 hosted zone that kOps would need to create (DNSZone task has no existing ZoneID) — RenderTerraform is invoked and immediately returns this error.","commonSituations":"Users switching an existing cluster from direct/cloud-target to terraform output while DNS zone is still marked to be created; new cluster specs where hosted zone ID is not supplied in the DNS config.","solutions":["Pre-create the hosted zone outside kOps (Route53 console, CLI, or your own TF module)","Add the existing zone's ID to the cluster spec (spec.dns ZoneID) so kOps reuses it via TerraformLink","Use a non-terraform target (e.g. --target=direct) if you want kOps to create the zone"],"exampleFix":"// before (kops cluster spec, terraform target)\n dns: { type: Public }\n// after\n dns: { type: Public, zone: \"Z1D633PJN98FT9\" }  // existing zone reused, no creation needed","handlingStrategy":"validation","validationCode":"// Ensure the zone exists and pass its ID before choosing --target=terraform\nout, err := svc.ListHostedZonesByName(ctx, &route53.ListHostedZonesByNameInput{DNSName: aws.String(dnsName)})\nif err != nil || len(out.HostedZones) == 0 {\n    return fmt.Errorf(\"create hosted zone %s before using terraform target\", dnsName)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pre-create Route53 zones when using --target=terraform","Set spec.dns zone ID in the cluster spec so kOps reuses it via TerraformLink","Run `terraform plan` to verify no zone resources are pending"],"tags":["aws","route53","terraform","dns"],"backgroundTag":"terraform-unsupported-resource","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}